Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...)

[Solar Designer <solar () openwall com>]

On Sat, Oct 18, 2025 at 01:16:36AM +0200, Vincent Lefevre wrote:
> Debian distributes Mark R. Boyns's rplay 3.3.2. I've had
> a very quick look at the source and found at least:
>
> * In rplay/rplay.c line 600, the use of atoi() on something that
>   looks like unsanitized data from a remote server:
>
>         remote_size = -1;
>         p = rptp_parse(response, "size");
>         if (p)
>             remote_size = atoi(p);
>
> * Various malloc() without a check of failure, such as:

These look like minor correctness and robustness issues.

In the code lines you quoted below, I am more worried about potential
for attacker triggerable integer overflows in calculation of malloc()
and realloc() sizes.  These have the potential of being vulnerabilities
worse than DoS, so may be worth further investigation.

> contrib/xjukebox-0.9/xjukebox.c-    *list = (spool_info **)realloc(*list, (*items_count + 1) *

> contrib/xjukebox-0.9/xjukebox.c-    *nlist = (String *)realloc(*nlist, (*items_count + 1) * sizeof(String));

> rx/rxanal.c:            *subexps = (struct rexp_node **)malloc (sizeof (struct rexp_node *) * *re_nsub);
> rx/rxanal.c-          else
> rx/rxanal.c-            *subexps = (struct rexp_node **)realloc (*subexps,
> rx/rxanal.c-                                                     sizeof (struct rexp_node *) * *re_nsub);

> My bug report in the Debian BTS:
>
>   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118224
>
> The upstream version was released in 1999, thus 26 years ago!
> And the rplay homepage no longer exists.
>
> Has anyone looked at this more closely?
> Are there CVEs?

I don't know.  I did a quick search now, and couldn't find any.

Alexander